THRIFT-6203: Replace deprecated url.parse and fs.exists in the Node.js library

lib/nodejs/lib/thrift/web_server.js

@@ -18,7 +18,7 @@
  */
 var http = require("http");
 var https = require("https");
-var url = require("url");
+var URL = require("url").URL;
 var path = require("path");
 var fs = require("fs");
 var crypto = require("crypto");
@@ -371,7 +371,7 @@ exports.createWebServer = function (options) {
   };
 
   //Setup all of the services
-  var services = options.services;
+  var services = options.services || {};
   for (var uri in services) {
     var svcObj = services[uri];
 
@@ -447,7 +447,16 @@ exports.createWebServer = function (options) {
   ///////////////////////////////////////////////////
   function processPost(request, response) {
     //Lookup service
-    var uri = url.parse(request.url).pathname;
+    var uri;
+    try {
+      // Only the pathname is used, so the base is fixed: a Host header that
+      // is not a valid authority must not turn into a 400 here.
+      uri = new URL(request.url, "http://localhost").pathname;
+    } catch (e) {
+      response.writeHead(400, "Bad Request", {});
+      response.end();
+      return;
+    }
     var svc = services[uri];
     if (!svc) {
       response.writeHead("403", "No Apache Thrift Service at " + uri, {});
@@ -529,7 +538,16 @@ exports.createWebServer = function (options) {
     }
 
     //Locate the file requested and send it
-    var uri = url.parse(request.url).pathname;
+    var uri;
+    try {
+      // Only the pathname is used, so the base is fixed: a Host header that
+      // is not a valid authority must not turn into a 400 here.
+      uri = new URL(request.url, "http://localhost").pathname;
+    } catch (e) {
+      response.writeHead(400, "Invalid request path", {});
+      response.end();
+      return;
+    }
     var filename = path.resolve(path.join(baseDir, uri));
 
     //Ensure the basedir path is not able to be escaped
@@ -540,14 +558,14 @@ exports.createWebServer = function (options) {
       return;
     }
 
-    fs.exists(filename, function (exists) {
-      if (!exists) {
+    fs.stat(filename, function (err, stats) {
+      if (err) {
         response.writeHead(404);
         response.end();
         return;
       }
 
-      if (fs.statSync(filename).isDirectory()) {
+      if (stats.isDirectory()) {
         filename += "/index.html";
       }
 

lib/nodejs/test/thrift_4987_xhr_protocol.test.mjs

@@ -45,7 +45,7 @@
  *   var thing = Buffer.from(data || buf);                      // line 143
  *
  * When `buf` is a string (which it always is from line 117), the ArrayBuffer
- * guard on line 140 is never reached — it is dead code.  `new Buffer(string)`
+ * guard on line 140 is never reached — it is dead code.  `Buffer.from(string)`
  * encodes the string as UTF-8: any character with code point 0x80–0xFF
  * becomes a 2-byte UTF-8 sequence, inflating the buffer and shifting all
  * subsequent byte positions.

lib/nodejs/test/web_server_ws.test.js

@@ -23,7 +23,9 @@
 // handshake does when there is no service to hand the connection to.
 
 const test = require("tape");
+const http = require("http");
 const net = require("net");
+const path = require("path");
 const crypto = require("crypto");
 const thrift = require("thrift/lib/nodejs/lib/thrift");
 const TBufferedTransport = require("thrift/lib/nodejs/lib/thrift/buffered_transport");
@@ -369,3 +371,38 @@ test("an ordinary frame is still delivered", function (assert) {
     }, 5000).unref();
   });
 });
+
+test("HTTP static file serving and URL handling", function (assert) {
+  const server = thrift.createWebServer({
+    files: path.resolve(__dirname),
+  });
+
+  server.listen(0, "127.0.0.1", function () {
+    const port = server.address().port;
+    const testFile = path.basename(__filename);
+
+    http.get(`http://127.0.0.1:${port}/${testFile}`, function (res) {
+      assert.equal(res.statusCode, 200, "served existing static file");
+
+      http.get(`http://127.0.0.1:${port}/no_such_file.txt`, function (res404) {
+        assert.equal(res404.statusCode, 404, "non-existent file returned 404");
+
+        const reqPost = http.request(
+          `http://127.0.0.1:${port}/unregistered_svc`,
+          { method: "POST" },
+          function (resPost) {
+            assert.equal(
+              resPost.statusCode,
+              403,
+              "unregistered service returned 403",
+            );
+            server.close(function () {
+              assert.end();
+            });
+          },
+        );
+        reqPost.end();
+      });
+    });
+  });
+});